PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-113679 harfbuzz CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-10-20T15:40:40.379Z and has not been modified since then. The vulnerability exists in HarfBuzz versions 8.0.0 through 14.6.0, affecting systems and applications that utilize this library. Defenders should assess exposure and prioritize patching due to the out-of-bounds write vulnerability in the experimental WebAssembly shaper. This vulnerability is caused by a wrong WAMR signature for the font_glyph_to_string import, potentially leading to crashes or corruption of applications using affected HarfBuzz versions.

Vendor
harfbuzz
Product
Unknown
CVSS
HIGH 7.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-20
Original CVE updated
2026-10-20
Advisory published
2026-10-20
Advisory updated
2026-10-20

Who should care

Defenders responsible for systems and applications using HarfBuzz versions 8.0.0 through 14.6.0 should assess exposure and prioritize patching. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify and apply patches for HarfBuzz versions 8.0.0 through 14.6.0. They should review and update affected systems and applications, monitor for potential exploitation attempts, and ensure that compens

Why it matters

Defenders should prioritize verifying and applying patches for HarfBuzz versions 8.0.0 through 14.6.0 due to an out-of-bounds write vulnerability in the experimental WebAssembly shaper.

  • Potential crashes or corruption of applications using affected HarfBuzz versions
  • Possible exploitation attempts targeting vulnerable systems and applications
  • Need for verification and patching of affected systems and applications
  • Potential impact on system and application reliability and security

Technical summary

The HarfBuzz library, versions 8.0.0 through 14.6.0, contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper. This vulnerability is caused by a wrong WAMR signature for the font_glyph_to_string import. The vulnerability exists due to improper handling of the font_glyph_to_string import in the WebAssembly shaper, allowing attackers to supply a crafted font whose wasm module places the output buffer near linear memory's end. This can lead to writing glyph-name bytes into host memory, potentially crashing or corrupting applications using affected HarfBuzz versions.

Defensive priority

Defenders should prioritize verifying and applying patches for HarfBuzz versions 8.0.0 through 14.6.0, as an out-of-bounds write vulnerability exists in the experimental WebAssembly shaper.

Recommended defensive actions

  • Verify and apply patches for HarfBuzz versions 8.0.0 through 14.6.0
  • Review and update affected systems and applications
  • Monitor for potential exploitation attempts
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the out-of-bounds write vulnerability in HarfBuzz 8.0.0 through 14.6.0. The vulnerability exists in the experimental WebAssembly shaper due to a wrong WAMR signature for the font_glyph_to_string import.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-113679 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-113679

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-113679 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-113679

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • HarfBuzz 8.0.0 through 14.6.0 Out-of-Bounds Write via WebAssembly font_glyph_to_string

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/113xxx/CVE-2026-113679.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://github.com/harfbuzz/harfbuzz/pull/6414

    Supplemental source - patch, issue-tracking

  • Source reference

    Unverified legacy reference

    URL: https://github.com/harfbuzz/harfbuzz/commit/5e821de8256d01780566b5c8ab7886fae4c93da8

    Supplemental source - patch

  • Source reference

    Unverified legacy reference

    URL: https://github.com/harfbuzz/harfbuzz/blob/14.6.0/src/hb-wasm-api-list.hh

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/harfbuzz/harfbuzz/blob/14.6.0/src/hb-wasm-api-font.hh

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/harfbuzz-8.0.0-through-14.6.0-out-of-bounds-write-via-webassembly-font-glyph-to-string

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.